onto-mcp 0.4.11 → 0.4.13

package/dist/core-runtime/reconstruct/seed-authoring-readiness-validation.js

@@ -1,6 +1,8 @@
 import fs from "node:fs/promises";
 import path from "node:path";
-import { parse as parseYaml, stringify as stringifyYaml } from "yaml";
+import { parse as parseYaml } from "yaml";
+import { atomicWriteYamlDocument as writeYamlDocument } from "../artifact-io.js";
+import { assertObligation } from "./obligation-assertion.js";
 const ONTOLOGY_DOMAIN_REQUIRED_CATEGORIES = [
     {
         category_id: "terminology_glossary",
@@ -70,10 +72,6 @@ async function readYamlDocumentIfPresent(filePath) {
         throw error;
     }
 }
-async function writeYamlDocument(filePath, value) {
-    await fs.mkdir(path.dirname(filePath), { recursive: true });
-    await fs.writeFile(filePath, stringifyYaml(value), "utf8");
-}
 function selectedPurposeCandidate(args) {
     const selectedId = args.sourcePurposeCandidatesValidation.selected_purpose_candidate_id;
     return args.sourcePurposeCandidates.purpose_candidates.find((candidate) => candidate.purpose_candidate_id === selectedId) ?? null;
@@ -139,8 +137,19 @@ function limitationRefsForElement(args) {
         return [];
     if (args.row.limitation_refs.length > 0)
         return args.row.limitation_refs;
-    if (purposeElementProjectsHandoffLimitation(args.element) &&
-        elementHasSourceEvidence(args)) {
+    if (elementHasSourceEvidence(args) && (purposeElementProjectsHandoffLimitation(args.element) ||
+        // Defect-2: a frontier_required element that has source evidence but no
+        // available frontier (no accepted frontier refs) is structurally a handoff
+        // limitation — frontier deepening cannot happen, so its closure converts to a
+        // recorded limitation rather than collapsing to `missing` (which would force
+        // frontier_required + no_concrete_frontier = a permanent gate-throw deadlock on
+        // single-source input). Routing through the existing handoff-limitation path
+        // makes it limitation_backed -> limited_seed_possible, exactly like an element
+        // the author explicitly declared as projecting handoff_limitations. Evidence
+        // presence is the safety boundary: a frontier_required element WITHOUT evidence
+        // stays `missing` (a genuine hole the gate still refuses).
+        (args.element.closure_expectation === "frontier_required" &&
+            args.frontierRefs.length === 0))) {
         return [`purpose_handoff_limitation:${slug(args.element.element_id)}`];
     }
     return [];
@@ -364,7 +373,7 @@ export function buildSeedAuthoringReadinessFromArtifacts(args) {
     const frontierRefs = acceptedFrontierRefIds(args.sourceFrontierValidations ?? []);
     const closureRows = purposeElements.map((element) => {
         const row = materialRowsByElement.get(element.element_id) ?? null;
-        const limitationRefs = limitationRefsForElement({ element, row });
+        const limitationRefs = limitationRefsForElement({ element, row, frontierRefs });
         return {
             closure_row_id: `seed-authoring-closure:${slug(element.element_id)}`,
             required_element_ref: element.element_id,
@@ -502,6 +511,44 @@ function normalizedRef(ref) {
 export function validateSeedAuthoringReadiness(args) {
     const violations = [];
     const artifact = args.seedAuthoringReadiness;
+    // G(a) deferred-7 slice 4: record only the obligation this validator FULLY + UNCONDITIONALLY enforces.
+    // Stamped at the top so it fires on any input. This validator receives already-parsed objects and runs a
+    // recompute-and-compare against buildSeedAuthoringReadinessFromArtifacts(args), so the slice-3 null-read
+    // false-pass does NOT apply here. asserted_obligation_ids is in-memory-only telemetry (Stage 0 #145) on a
+    // reuse-hashed artifact (run.ts seed_authoring_readiness_validation_sha256), so stamping does not rotate reuse.
+    //
+    // RECORD 1:
+    //  - validate_blocked_validation_gap_is_projection_not_semantic_decision → readiness_classification_mismatch
+    //    (+ closure_row_invalid_state): blocked_validation_gap is recomputed deterministically from input
+    //    validation status and compared UNCONDITIONALLY (single scalar), so it cannot be overridden by a
+    //    hand-authored semantic decision (tests: "rejects tampered readiness classification" + "projects
+    //    blocked_validation_gap before semantic readiness states"). Immune to both codex #150 edges below.
+    //
+    // PARKED 7 (ledger notes carry the codex-referenced detail):
+    //  - validate_readiness_consumes_pre_seed_source_scout_validation_snapshot: codex #150 P2 — the three
+    //    source_scout_pre_seed_identity_mismatch checks are GATED on sourceScoutPackValidationRef/Validation being
+    //    present; an absent/null snapshot is handled by the validation-gap mechanism, not the identity check, so an
+    //    unconditional top stamp would over-claim pre-seed consumption for gap-only executions.
+    //  - validate_selected_purpose_required_elements_have_closure_rows: codex #150 P2 — expected and actual
+    //    closure rows are keyed by required_element_ref in a Map, so duplicate element_ids (not rejected upstream)
+    //    collapse and one closure row can satisfy multiple required elements → a missing duplicate is not caught.
+    //  - validate_readiness_projection_uses_validated_input_refs_only: the closure-row validated_upstream_refs /
+    //    llm_authority_refs projection fields are never compared; the only input-validation gate is the gap
+    //    mechanism, whose binding is readiness_classification_mismatch (recorded above) — no distinct binding.
+    //  - validate_actor_action_state_scout_rows_do_not_replace_purpose_required_elements: the boundary note is
+    //    presence-only, and closure_row_dangling_required_element rejects foreign-ref rows but never verifies a
+    //    row's material is purpose-derived rather than scout-derived (a scout row under a valid ref passes).
+    //  - validate_frontier_required_preserves_exploration_budget_state_without_declaring_source_insufficiency:
+    //    compound — source_sufficiency_state is recompute-compared, but exploration_budget_state is COPIED from
+    //    the artifact (not compared), so the "preserves exploration_budget_state" half is unenforced.
+    //  - validate_ontology_domain_required_category_rows_only_when_selected_purpose_closure_rows_resolve_to_
+    //    domain_categories: asymmetric — only expected→actual presence (ontology_domain_category_missing) is
+    //    checked; spurious/orphan category rows are never rejected, so the "only when" direction is unenforced.
+    //  - validate_only_seed_ready_or_limited_seed_possible_allows_seed_authoring: DELEGATED to the sibling
+    //    assertSeedAuthoringReadinessAllowsSeed gate; validateSeedAuthoringReadiness returns valid for
+    //    frontier_required, so the allow-gate is not enforced by this function.
+    const assertedObligationIds = [];
+    assertObligation(assertedObligationIds, "validate_blocked_validation_gap_is_projection_not_semantic_decision");
     if (artifact.session_id !== args.sourcePurposeCandidates.session_id) {
         violations.push(violation({
             code: "session_id_mismatch",
@@ -655,6 +702,7 @@ export function validateSeedAuthoringReadiness(args) {
         validation_results: violations.length === 0
             ? ["seed_authoring_readiness_valid"]
             : ["seed_authoring_readiness_invalid"],
+        asserted_obligation_ids: assertedObligationIds,
         violations,
     };
 }

package/dist/core-runtime/reconstruct/semantic-quality-gate.js

@@ -47,8 +47,14 @@ const GOLDEN_FIXTURES = {
                 name_alternates: ["explainfixture", "fixtureexplanation"],
             },
             {
+                // Q1 presence is credited by a source binding (with a source_ref) whose
+                // seed_ref resolves to the fixture-service object — not by binding-id
+                // spelling (the old name_alternates were fit to the mock's
+                // `binding-fixture-source` id and missed descriptive live ids).
+                // name_alternates remain for the Q2 CQ linkage.
                 concept_key: "fixture-source-binding",
                 name_alternates: ["fixturesource", "bindingfixturesource", "sourcebinding"],
+                binding_target_alternates: ["fixtureservice"],
             },
         ],
         expected_cq: [
@@ -132,8 +138,14 @@ const GOLDEN_FIXTURES = {
                 name_alternates: ["checkoutbook", "checkout", "borrowbook", "loanbook"],
             },
             {
+                // Q1 presence is credited by a source binding (with a source_ref) whose
+                // seed_ref resolves to the loan-record object. The `loanrecord`
+                // name_alternate also matches the LoanRecord object NAME, so using it for
+                // Q1 would wrongly credit a seed that has the object but no binding; Q1
+                // here is binding-targeted only, and name_alternates remain for Q2.
                 concept_key: "loan-record-binding",
                 name_alternates: ["loanrecord", "loanbinding"],
+                binding_target_alternates: ["loanrecord"],
             },
         ],
         expected_cq: [
@@ -219,7 +231,66 @@ function seedNameRows(seed) {
     }
     return rows;
 }
-function conceptMatch(expected, rows) {
+/**
+ * The object_type ids whose object NAME matches a binding-target alternate. The
+ * target object is identified by its NAME (model-agnostic on the id), and the
+ * binding is then tied to it by EXACT seed_ref == object_type_id (below), so no
+ * substring matching ever runs over model-chosen ids. Only `semantic_layer.
+ * object_types` are scanned — a source binding must back an object type, not a
+ * concept/action/actor (which would let the fixture pass without the backed
+ * object it measures).
+ */
+function targetObjectTypeIds(objectTypeRows, targetAlternates) {
+    const ids = new Set();
+    for (const row of objectTypeRows) {
+        const name = normalizeName(stringField(row, "name"));
+        if (name.length === 0)
+            continue;
+        if (targetAlternates.some((alternate) => name.includes(normalizeName(alternate)))) {
+            const id = stringField(row, "object_type_id").trim();
+            if (id.length > 0)
+                ids.add(id);
+        }
+    }
+    return ids;
+}
+/**
+ * Whether a source binding satisfies a binding-target concept: it must name a
+ * backing source (`source_ref` present) and target the right object — its
+ * (trimmed) `seed_ref` is EXACTLY one of the target object type ids. Id equality
+ * (not substring) means a descriptive binding id, an opaque object id, incidental
+ * whitespace, or a mis-named object cannot leak a false match.
+ */
+function bindingTargetsConcept(binding, targetObjectIds) {
+    if (stringField(binding, "source_ref").trim().length === 0)
+        return false;
+    return targetObjectIds.has(stringField(binding, "seed_ref").trim());
+}
+function conceptMatch(expected, rows, sourceBindings, objectTypeRows) {
+    // A binding-target concept's PRESENCE (Q1) is credited only by a source
+    // binding (with a source_ref) whose seed_ref is exactly the id of an object
+    // type the fixture names. `name_alternates` are NOT used for Q1 presence here —
+    // they would also match the target object's own NAME and credit the binding
+    // concept for a seed that has the object but no binding; they remain for the Q2
+    // CQ↔concept linkage.
+    if (expected.binding_target_alternates) {
+        const targetIds = targetObjectTypeIds(objectTypeRows, expected.binding_target_alternates);
+        for (const binding of sourceBindings) {
+            if (bindingTargetsConcept(binding, targetIds)) {
+                return {
+                    concept_key: expected.concept_key,
+                    matched_name: [
+                        stringField(binding, "binding_id"),
+                        stringField(binding, "seed_ref"),
+                    ]
+                        .filter((value) => value.length > 0)
+                        .join(" "),
+                    seed_family: "data_binding_layer.source_bindings",
+                };
+            }
+        }
+        return null;
+    }
     for (const row of rows) {
         const normalized = normalizeName(row.name);
         for (const alternate of expected.name_alternates) {
@@ -236,18 +307,29 @@ function conceptMatch(expected, rows) {
 }
 /**
  * Explicit no-call exemptions: the only LLM-owned units with a runtime path
- * that completes without any LLM call (a not-required purpose confirmation,
- * or maturation units the runtime authors as empty projections when the
- * question frontier is empty). Every other completed non-runtime unit must
- * carry telemetry — reject-by-default, so a newly added authored unit cannot
- * silently skip measurement provenance.
+ * that completes without any LLM call (a not-required purpose confirmation, or
+ * maturation units the runtime authors as empty projections — when the question
+ * frontier is empty, or, for the answer-support judge, when the ledger has no
+ * convergent_source_evidence cluster). Every other completed non-runtime unit
+ * must carry telemetry — reject-by-default, so a newly added authored unit
+ * cannot silently skip measurement provenance.
  */
 const NO_CALL_EXEMPT_UNIT_IDS = new Set([
     "purpose_confirmation",
     "maturation_question_frontier",
     "maturation_closure_frontier",
+    "answer_support_judgment",
     "maturation_answer_claims",
     "ontology_expansion",
+    // leaf-read is a conditional LLM-touch: when no spreadsheet region triggers a read (no spreadsheet
+    // source, or structure already complete), the stage completes with no LLM call but still writes its
+    // census artifact (the R9 honest-signal). A leaf-read that DID call records leaf_read telemetry; the
+    // census itself records attempts/failures, so an exempt no-call completion still carries provenance.
+    "leaf_read",
+    // Layer-2 semantic_map (W3 review onto issue-003): same conditional-LLM-touch shape as leaf_read —
+    // a capability-present run with no evaluatable observation (or a fully preflight-capped one)
+    // completes with ZERO calls but still writes its census/sidecar (the provenance surface).
+    "semantic_map",
 ]);
 /**
  * Source-field rejection: completed LLM units must carry the telemetry
@@ -327,10 +409,12 @@ export function evaluateReconstructGoldenQualityGate(args) {
     }
     // Q1 — expected-concept recall over the authored seed.
     const nameRows = seedNameRows(args.ontologySeed);
+    const sourceBindings = recordRows(args.ontologySeed.data_binding_layer, "source_bindings");
+    const objectTypeRows = recordRows(args.ontologySeed.semantic_layer, "object_types");
     const matches = [];
     const missing = [];
     for (const expected of spec.expected_concepts) {
-        const match = conceptMatch(expected, nameRows);
+        const match = conceptMatch(expected, nameRows, sourceBindings, objectTypeRows);
         if (match)
             matches.push(match);
         else
@@ -357,9 +441,30 @@ export function evaluateReconstructGoldenQualityGate(args) {
         if (!concept) {
             throw new Error(`Fixture ${spec.fixture_id} expected_cq ${expected.cq_key} links unknown concept ${expected.linked_concept_key}`);
         }
+        // A binding-target concept's CQ is supported only when a question explicitly
+        // references one of the run's TARGETING bindings BY ID (exact equality on a
+        // claim/seed ref). The object name or seed_ref must NOT credit it — a question
+        // merely about the object is not a question about its backing source — and an
+        // id SUBSTRING must not (a short binding_id like `b1` would collide with an
+        // unrelated ref `object-b10`). With no targeting binding the set is empty, so
+        // the binding CQ cannot be supported — the missing-binding case Q1 catches.
+        // Non-binding concepts link via name_alternates over the question text/refs.
         const question = args.competencyQuestions.questions.find((candidate) => {
             if (usedQuestionIds.has(candidate.question_id))
                 return false;
+            if (concept.binding_target_alternates) {
+                const targetIds = targetObjectTypeIds(objectTypeRows, concept.binding_target_alternates);
+                const bindingIds = new Set(sourceBindings
+                    .filter((binding) => bindingTargetsConcept(binding, targetIds))
+                    .map((binding) => stringField(binding, "binding_id").trim())
+                    .filter((id) => id.length > 0));
+                if (bindingIds.size === 0)
+                    return false;
+                return [
+                    ...(candidate.linked_claim_ids ?? []),
+                    ...(candidate.seed_ref_refs ?? []),
+                ].some((ref) => bindingIds.has(ref.trim()));
+            }
             const haystack = normalizeName([
                 candidate.question_id,
                 candidate.question,

package/dist/core-runtime/reconstruct/source-observation-delta-validation.js

@@ -1,18 +1,16 @@
 import crypto from "node:crypto";
 import fs from "node:fs/promises";
 import path from "node:path";
-import { parse as parseYaml, stringify as stringifyYaml } from "yaml";
+import { parse as parseYaml } from "yaml";
+import { assertArrayField, atomicWriteYamlDocument as writeYamlDocument } from "../artifact-io.js";
 import { sourceSafetyRowIdForObservation } from "./source-safety-validation.js";
+import { assertObligation } from "./obligation-assertion.js";
 function isoNow() {
     return new Date().toISOString();
 }
 async function readYamlDocument(filePath) {
     return parseYaml(await fs.readFile(filePath, "utf8"));
 }
-async function writeYamlDocument(filePath, value) {
-    await fs.mkdir(path.dirname(filePath), { recursive: true });
-    await fs.writeFile(filePath, stringifyYaml(value), "utf8");
-}
 function stableJson(value) {
     if (Array.isArray(value)) {
         return `[${value.map(stableJson).join(",")}]`;
@@ -70,6 +68,7 @@ function samePathRef(left, right) {
     return path.resolve(left) === path.resolve(right);
 }
 function observationsBySourceRef(observations) {
+    assertArrayField(observations.observations, "source-observations", "observations");
     return new Map(observations.observations.map((observation) => [
         path.resolve(observation.source_ref),
         observation,
@@ -191,7 +190,20 @@ export function buildSourceObservationDeltaArtifact(args) {
     };
 }
 export function validateSourceObservationDelta(args) {
+    assertArrayField(args.sourceObservations.observations, "source-observations", "observations");
+    assertArrayField(args.delta.delta_rows, "source-observation-delta", "delta_rows");
+    assertArrayField(args.delta.accepted_frontier_ref_ids, "source-observation-delta", "accepted_frontier_ref_ids");
+    assertArrayField(args.delta.added_observation_ids, "source-observation-delta", "added_observation_ids");
     const violations = [];
+    // G(a) slice 5: record the four delta obligations with a distinct enforcement region, before any
+    // per-row loop so they are proven wired on a zero-row delta. validate_delta_frontier_kind_is_supported
+    // stays parked (ledger audit note): normalizeFrontierForDelta checks kind-vs-artifact CONSISTENCY,
+    // not that the kind value itself is in a supported set, so an unsupported kind can fall through.
+    const assertedObligationIds = [];
+    assertObligation(assertedObligationIds, "validate_delta_observation_refs_exist_in_source_observations");
+    assertObligation(assertedObligationIds, "validate_delta_rows_match_accepted_frontier_refs");
+    assertObligation(assertedObligationIds, "validate_delta_rows_preserve_observation_batch_id_and_triggering_frontier_validation_ref");
+    assertObligation(assertedObligationIds, "validate_delta_source_ref_material_kind_and_observation_hash_match_observed_content");
     if (args.delta.schema_version !== "1") {
         violations.push(violation({
             code: "schema_shape_invalid",
@@ -378,11 +390,23 @@ export function validateSourceObservationDelta(args) {
         validation_results: violations.length === 0
             ? ["source_observation_delta_valid"]
             : ["source_observation_delta_invalid"],
+        asserted_obligation_ids: assertedObligationIds,
         violations,
     };
 }
 export function validateSourceObservationReentry(args) {
+    assertArrayField(args.sourceObservations.observations, "source-observations", "observations");
+    assertArrayField(args.sourceSafetyLedger.safety_rows, "source-safety-ledger", "safety_rows");
+    assertArrayField(args.delta.added_observation_ids, "source-observation-delta", "added_observation_ids");
     const violations = [];
+    // G(a) slice 5: record the four re-entry obligations. R1/R4 are top-level gate checks; R2/R3 are
+    // per-observation, so all four are stamped before the loop to be proven wired on a zero-observation
+    // delta. Each was audited to a distinct enforcement region (no laundering).
+    const assertedObligationIds = [];
+    assertObligation(assertedObligationIds, "validate_delta_validation_passed_before_prompt_reentry");
+    assertObligation(assertedObligationIds, "validate_each_delta_observation_exists_in_source_observations");
+    assertObligation(assertedObligationIds, "validate_each_delta_observation_has_exact_prompt_context_source_safety_row");
+    assertObligation(assertedObligationIds, "validate_source_safety_validation_passed_before_prompt_reentry");
     if (args.delta.schema_version !== "1") {
         violations.push(reentryViolation({
             code: "schema_shape_invalid",
@@ -458,11 +482,34 @@ export function validateSourceObservationReentry(args) {
         validation_results: violations.length === 0
             ? ["source_observation_reentry_valid"]
             : ["source_observation_reentry_invalid"],
+        asserted_obligation_ids: assertedObligationIds,
         violations,
     };
 }
 export async function validateSourceObservationLineageIndex(args) {
+    assertArrayField(args.sourceObservations.observations, "source-observations", "observations");
+    assertArrayField(args.lineageIndex.lineage_rows, "source-observation-lineage-index", "lineage_rows");
     const violations = [];
+    // G(a) deferred-7 slice 3: record only the uniqueness obligation this validator fully enforces. Stamped
+    // before the per-row loop so it fires on zero rows. asserted_obligation_ids is in-memory-only telemetry
+    // (Stage 0 #145) on a reuse-hashed + scout-captured artifact, so stamping does not rotate reuse.
+    // validate_unique_session_level_lineage_row_ids → duplicate_id (the `seen` set below rejects any repeated
+    // lineage_row_id, including a repeated blank/absent id).
+    //
+    // PARKED (codex #149 R1, all false-pass edges of this gap-prone lineage validator):
+    //  - require_each_lineage_row_{delta,reentry}_validation_to_be_valid, validate_each_lineage_row_delta_ref_
+    //    is_readable_and_session_matching, validate_lineage_added_observation_ids_match_delta_added_observation_
+    //    ids: a ref pointing at an EXISTING EMPTY/null YAML makes readYamlDocument return null WITHOUT throwing,
+    //    so the catch (..._missing) never fires AND the `if (delta)` / `if (deltaValidation)` / `if (reentry
+    //    Validation)` guards skip every check — the row passes valid. Not fully enforced until non-object reads
+    //    are rejected.
+    //  - validate_each_lineage_added_observation_exists_in_source_observations: checks membership in the PASSED
+    //    sourceObservations object only; it is never bound to the delta/re-entry chain's source_observations_ref
+    //    or session, so a wrong/stale source-observations file with the same ids passes (caller-supplied authority).
+    //  - validate_each_lineage_added_observation_was_reentered_by_its_validation: shares the
+    //    lineage_added_observation_mismatch code with the added-ids-match obligation (no distinct binding; slice-21).
+    const assertedObligationIds = [];
+    assertObligation(assertedObligationIds, "validate_unique_session_level_lineage_row_ids");
     const seen = new Set();
     const observationsById = new Map(args.sourceObservations.observations.map((observation) => [observation.observation_id, observation]));
     const addedObservationIds = new Set();
@@ -670,6 +717,7 @@ export async function validateSourceObservationLineageIndex(args) {
         validation_results: violations.length === 0
             ? ["source_observation_lineage_index_valid"]
             : ["source_observation_lineage_index_invalid"],
+        asserted_obligation_ids: assertedObligationIds,
         violations,
     };
 }

package/dist/core-runtime/reconstruct/source-observations.js

@@ -1,3 +1,5 @@
+import { inventoryHasInspectedStructure, SPREADSHEET_CAPTURE_TRUNCATED_PHRASE, SPREADSHEET_MACRO_PRESENT_PHRASE, SPREADSHEET_OBSERVER_ADAPTER_ID, VALIDATION_MEMBER_CHAR_CAP, VALIDATION_MEMBER_COUNT_CAP, } from "../spreadsheet-structure-observer.js";
+import { validateComprehensionArtifact, } from "./comprehension-artifact.js";
 const PROHIBITED_STRUCTURAL_KEYS = new Set([
     "aggregate_root",
     "business_entity",
@@ -31,6 +33,142 @@ function collectObjectKeys(value, keys = []) {
     }
     return keys;
 }
+/** Lowercase 64-char hex (a raw-byte sha256). */
+const CONTENT_SHA256_PATTERN = /^[0-9a-f]{64}$/;
+/**
+ * P6 spreadsheet honesty/provenance assertions — the positive complement of the
+ * prohibition checks above: what a spreadsheet observation MUST honestly disclose.
+ * Runs only for spreadsheet observations; CRUCIALLY it exempts the legitimate
+ * UNSUPPORTED states the observer deliberately emits (empty-csv placeholder,
+ * oversized/unreadable with an empty hash) so the gate never converts an honest
+ * "nothing to inspect / could not read" inventory into a hard crash (the validator
+ * throws inside the builder, before the materialize loop's graceful skip-demotion).
+ */
+function validateSpreadsheetObservationHonesty(observation, violations) {
+    const inventory = observation.structural_data.workbook_inventory;
+    // An array is `typeof "object"` too; reject it like the prompt-projection recompute
+    // does — this validator is also the boundary for persisted/replayed observations,
+    // so a malformed `workbook_inventory: []` must not pass as a valid inventory.
+    if (!inventory || typeof inventory !== "object" || Array.isArray(inventory)) {
+        violations.push("spreadsheet observation must carry a workbook_inventory in structural_data");
+        return;
+    }
+    // `unsupported_reason` is three-valued: null (supported), a non-empty string
+    // (genuinely unsupported), or a present-but-BLANK string (incoherent). A blank
+    // reason would skip the supported hash check yet not demote downstream
+    // (spreadsheetUnsupportedReason ignores blanks), admitting a no-evidence workbook —
+    // reject it explicitly so the honest disclosure is never empty.
+    const reason = inventory.unsupported_reason;
+    if (typeof reason === "string" && reason.trim() === "") {
+        violations.push("unsupported_reason must not be blank");
+        return;
+    }
+    const supported = reason == null;
+    if (supported) {
+        // B (provenance anchor): a SUPPORTED workbook (bytes actually read) must carry a
+        // well-formed raw-byte content hash at the TOP level — the field the source-scout-
+        // pack provenance consumer binds to (materialize-preparation surfaces it there).
+        // It is a presence/format check on the raw-byte content hash. An UNSUPPORTED
+        // inventory may legitimately carry an empty hash (oversized/unreadable: bytes
+        // never read) — its unsupported_reason is the honest disclosure.
+        const sha = observation.structural_data.content_sha256;
+        if (typeof sha !== "string" || !CONTENT_SHA256_PATTERN.test(sha)) {
+            violations.push("content_sha256_missing");
+        }
+        else if (sha !== inventory.content_sha256) {
+            // The top-level hash anchors source-scout provenance; the nested inventory hash
+            // is projected into prompts. A corrupted/replayed envelope where they disagree
+            // would let the two name different raw bytes — assert they match.
+            violations.push("content_sha256 disagrees with workbook_inventory hash");
+        }
+    }
+    else if (inventoryHasInspectedStructure(inventory)) {
+        // C (unsupported<->empty coherence): an unsupported inventory must not claim any
+        // inspected structure across the full inventory surface, not just `sheets`.
+        violations.push("unsupported spreadsheet inventory must not claim inspected structure");
+    }
+    // D (truncation/macro honesty): when the inventory flags partial capture or macro
+    // presence, the prompt-visible summary MUST disclose it with the fixed phrase the
+    // producer emits (assert + emit bound to the same literal so they cannot drift).
+    if (inventory.capture_truncated &&
+        !observation.summary.includes(SPREADSHEET_CAPTURE_TRUNCATED_PHRASE)) {
+        violations.push("capture_truncated not disclosed in observation summary");
+    }
+    if (inventory.macro_present &&
+        !observation.summary.includes(SPREADSHEET_MACRO_PRESENT_PHRASE)) {
+        violations.push("macro_present not disclosed in observation summary");
+    }
+    // E (design-C value-aware bound): the ONLY value-bearing field is
+    // data_validations[].members — the declared type=list enum labels. This enforces BOUNDS +
+    // INTERNAL CONSISTENCY only: any entry carrying members must be validation_type === "list"
+    // with count <= VALIDATION_MEMBER_COUNT_CAP and each member <= VALIDATION_MEMBER_CHAR_CAP.
+    // formula1 PROVENANCE (that members came from an inline literal, not observed cells) is an
+    // emission-time guarantee in the observer, NOT replay-verifiable here — a forged
+    // members+type=list pair is outside this honesty model (documented limitation).
+    // Codex round3 #5: a replayed / host-supplied artifact may carry a non-array (or missing)
+    // data_validations; guard before iterating so a malformed observation degrades to valid:false
+    // rather than throwing "not iterable" out of the boundary check.
+    if (!Array.isArray(inventory.data_validations)) {
+        violations.push("data_validations is missing or not an array");
+    }
+    for (const dv of Array.isArray(inventory.data_validations)
+        ? inventory.data_validations
+        : []) {
+        if (dv.members === undefined)
+            continue;
+        // Replayed / host-supplied artifacts are untyped despite the cast: a non-string member would
+        // make the length bounds silently pass (members:[123] → m.length undefined) or throw
+        // (members:"abc" → no .some). Reject non-string-array members before the bounds (Codex #3).
+        if (!Array.isArray(dv.members) ||
+            dv.members.some((m) => typeof m !== "string")) {
+            violations.push("data_validation members must be an array of strings");
+            continue;
+        }
+        if (dv.validation_type !== "list") {
+            violations.push("data_validation members present but validation_type is not 'list'");
+        }
+        if (dv.members.length > VALIDATION_MEMBER_COUNT_CAP) {
+            violations.push("data_validation members exceed VALIDATION_MEMBER_COUNT_CAP");
+        }
+        if (dv.members.some((m) => m.length > VALIDATION_MEMBER_CHAR_CAP)) {
+            violations.push("data_validation member exceeds VALIDATION_MEMBER_CHAR_CAP");
+        }
+    }
+    // E2 (P1-C1 value-tile safety): segmented_value_tiles is aggregate-only — type/shape/format
+    // counts, capped distinct COUNTS (never values), lower-bound flags, row anchors. Its only
+    // string-bearing fields are format-identities (the SANITIZED display-format grammar). A quoted
+    // literal there would mean a domain literal (e.g. "USD", "Customer:") leaked past
+    // normalizeFormatCode — reject it so a forged/replayed artifact cannot smuggle source text into
+    // a prompt-visible tile. (Bounds are structural: caps live in value_tile_config.)
+    const valueTiles = inventory.segmented_value_tiles;
+    if (valueTiles !== undefined) {
+        if (!Array.isArray(valueTiles)) {
+            violations.push("segmented_value_tiles must be an array when present");
+        }
+        else {
+            let unsanitized = false;
+            for (const sheet of valueTiles) {
+                for (const col of sheet.columns ?? []) {
+                    for (const seg of col.segments ?? []) {
+                        if (Object.keys(seg.format_counts ?? {}).some((fid) => fid.includes('"'))) {
+                            unsanitized = true;
+                        }
+                    }
+                    for (const note of col.intra_tile_notes ?? []) {
+                        if (note.boundary_kind === "display_format" &&
+                            ((typeof note.prev_shape === "string" && note.prev_shape.includes('"')) ||
+                                (typeof note.new_shape === "string" && note.new_shape.includes('"')))) {
+                            unsanitized = true;
+                        }
+                    }
+                }
+            }
+            if (unsanitized) {
+                violations.push("value-tile format-identity must be sanitized (no quoted literal)");
+            }
+        }
+    }
+}
 export function validateSourceObservationBoundary(observation) {
     const violations = [];
     if (!observation.observation_id.trim()) {
@@ -46,6 +184,24 @@ export function validateSourceObservationBoundary(observation) {
         !observation.observation_batch_id.trim()) {
         violations.push("observation_batch_id must not be blank when present");
     }
+    // Defect-3 basis A is forgery-resistant at the artifact boundary (covers
+    // persisted/replayed/host-supplied observations, not just freshly produced ones):
+    if ("is_runtime_target_source" in observation) {
+        // (a) fail-closed type: downstream source-safety treats ONLY literal boolean
+        // true as Basis A, so a non-boolean must not pass the boundary silently.
+        if (observation.is_runtime_target_source !== undefined &&
+            typeof observation.is_runtime_target_source !== "boolean") {
+            violations.push("is_runtime_target_source must be a boolean when present");
+        }
+        // (b) mutual exclusion: a runtime-target source is the user-provided initial
+        // target and is never a frontier re-entry. Rejecting target+trigger blocks a
+        // replayed/forged frontier observation from claiming runtime-target provenance.
+        if (observation.is_runtime_target_source === true &&
+            typeof observation.triggering_frontier_validation_ref === "string" &&
+            observation.triggering_frontier_validation_ref.trim()) {
+            violations.push("is_runtime_target_source must not be true on a frontier re-entry observation (triggering_frontier_validation_ref present)");
+        }
+    }
     if (!observation.adapter_id.trim()) {
         violations.push("adapter_id is required");
     }
@@ -65,6 +221,16 @@ export function validateSourceObservationBoundary(observation) {
             violations.push(`summary contains prohibited ontology interpretation: ${label}`);
         }
     }
+    if (observation.adapter_id === SPREADSHEET_OBSERVER_ADAPTER_ID) {
+        validateSpreadsheetObservationHonesty(observation, violations);
+    }
+    // P1-C1 §5.7: validate the companion ComprehensionArtifact when present (construction + replay).
+    // Completeness is fail-closed (a silently-missing baseline field is a violation), so an invalid
+    // contract throws at construction (the materialize loop) and is rejected on replay.
+    const comprehensionArtifact = observation.structural_data.comprehension_artifact;
+    if (comprehensionArtifact !== undefined) {
+        validateComprehensionArtifact(comprehensionArtifact, violations);
+    }
     return {
         valid: violations.length === 0,
         violations,